VC-60045: Add workspace support to the NGTS connector

[eunenbat-panw]

VC-60045: Add workspace support to the NGTS connector

Summary

Adds optional workspace scoping to the Palo Alto Networks NGTS connector. When a workspace is set, every NGTS API and GraphQL request carries workspace_id=<id>, so certificate operations run in that workspace. When no workspace is set, behaviour is unchanged.

Companion to VC-60044 (vcert Go).

Usage

conn = venafi_connection(platform=VenafiPlatform.NGTS, client_id=..., client_secret=...,
                         tsg_id=..., workspace="1000")
# or, on an existing connection
conn.set_workspace("1000")

What changed

• NGTSConnection
  • New optional workspace argument and a set_workspace() method.
  • The workspace is added as a workspace_id query parameter in one place, which covers REST and GraphQL. Any existing query parameters are kept.
  • The workspace is not sent to the OAuth token endpoint, which ignores it.
• Validation: a workspace is a numeric ID (1–10 digits), never a name. Invalid values raise ClientBadData before any request is sent.
• set_policy inside a workspace: raises ClientBadData with a clear message. Issuing templates belong to the tenant and are read-only within a workspace, so NGTS would reject the write with 403/1002 anyway.
• venafi_connection(workspace=...): passes the workspace to NGTS, and raises VenafiError if the workspace would end up on a non-NGTS connector, so it's never silently dropped.
• Docs: README-NGTS.md has a new Workspaces section, and docs/version_history.md has a 0.23.0 entry.

Backward compatibility

• workspace is optional and was added as the last argument, so existing calls are unaffected.
• With no workspace, outgoing requests are byte-for-byte the same as on master. This was checked by recording the requests on both branches.
• master's unmodified offline tests pass against this branch.

Testing

• Offline: new unit tests cover:
  • how the query parameter is added (merged with existing parameters, idempotent, untouched when no workspace is set)
  • ID validation
  • the GET/POST/PUT paths
  • the token request not getting the workspace
  • the set_policy guard
  • the factory guard
• Live (NGTS dev tenant):
  • No workspace: 9 passed, 1 skipped (revoke is unsupported by the Built-In CA).
  • NGTS_WORKSPACE=1000: 8 passed, 2 skipped (revoke; the policy round-trip, which needs tenant level).
  • NGTS_WORKSPACE is optional in the live suite, so leaving it unset still tests the default path.

Also included

test_ngts_set_get_policy_roundtrip now sets serviceGenerated=False, which NGTS requires to create a template. The test no longer checks max_valid_days, because that value never reads back (a separate, pre-existing bug).

Known issues (existing, not addressed here)

• Updating a template wipes its workspace sharing. set_policy replaces the whole template, and consumerTsgIds isn't part of the policy spec, so an update removes the template from every workspace. The fix is planned as a follow-up.
• get_policy doesn't round-trip into set_policy in two cases:
  • domains: [".*"] is escaped into a restrictive regex.
  • maxValidDays always reads back as None, because the parser looks at the top level while the value is stored under product.

🤖 Generated with Claude Code